The file ZDLXESWG.EXE is identified as the Trojan Program that is used for stealing bank information and users passwords.
To delete ZDLXESWG.EXE we suggest you should use UnHackMe:
http://www.unhackme.com
Malware Analysis of ZDLXESWG.EXE
Full path on a computer: %Temp%\zdlxeswg.exe
Detected by UnHackMe:
ZDLXESWG.EXE
Default location: %Temp%\zdlxeswg.exe
Removal Results: Success
Number of reboot: 1
ZDLXESWG.EXE is known as:
Trojan.Dorkbot.ED, Trojan ( 0048fa7b1 ), Trojan.Inject.gsul, TR.Dropper.VB.1962, Win32.Boaxxe.BE, Trojan.Inject, W32.Dorkbot.BAA.tr, Trojan.Inject.aEVX
ZDLXESWG.EXE hash:
- MD5: 793d3a8059a7e2654139189638cb001d
How to quickly detect ZDLXESWG.EXE presence?
![]( "Registry")
Registry:
![]( "Folders")
Folders:
![]( "Files")
Files:
Registry:- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\{3356C7A5-29FF-4131-33B6-D1CB34F3BE41}: “%Temp%\zdlxeswg.exe”
Folders:- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\components
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4
Files:- %Appdata%\Microsoft\Protect\S-1-5-21-1659004503-1708537768-1801674531-500\8d74a6c8-bd6a-4086-a6fc-ca16ae43acbd
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\chrome.manifest
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\components\BroadcastEventService.js
- %Appdata%\Mozilla\Firefox\Profiles\profile.default\extensions\{0B129884-0F69-B02F-2C4A-F42D723D8D77}\install.rdf
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\background.js
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\content.js
- %Local Appdata%\Google\Chrome\User Data\Default\iejibcalgjapcplacmekpecnhcdninhh\4.0.4\manifest.json
- %Temp%\data.dat
- %Temp%\setup.dat
- %Temp%\zdlxeswg.exe
- %Temp%\~DFD3B3.tmp